Purism Librem 5 Hardware Schematics - <AUTHOR> https://puri.sm/posts/a-different-kind-of-transparency/ <comment><USER2> (Not a criticism of purism but of how little is required to say "Open Hardware" in general). I have to say how disappointing it is what counts as open hardware. A simple schematic and some xrays? Why not the Kicad(I'm pretty sure that's what they said they used to make it) files, or maybe an openboardview [1] .brd file that would actually help for device repair and hacking on the phone at a hardware level.

As a comparison to FOSS this is the equivalent of releasing a binary and some header files.

[1] [https://openboardview.org/](https://openboardview.org/)

<comment><USER3> >I'm pretty sure that's what they said they used to make it

That was said about the devkit.

Gerber files are supposed to be released in a few years, after recouping development costs.

<comment><USER4> I sure hope this is true, and it would be a show of good faith to give it to anyone who asks that also signs an NDA or something until the development costs are recouped so people can at least repair them easily.

</comment></comment></comment><comment> cia-killer Pretty interesting, I hope they make something similar for the laptops. I use an x200 with Libreboot to avoid the proprietary software in new Intel chips and the bios. It's still fast since I use Arch with dwm, but at some point in the future I would like to switch.

<comment><USER5> > x200 with Libreboot

How safe are those now that the Intel vulnerabilities are known? I doubt hardware that old is getting microcode updates.

<comment><USER6> You can disable hyperthreading to mitigate a lot of Intel vulnerabilities. Qubes, which is a popular OS choice within the coreboot crowd, does this by default.

<comment><USER5> But not all of them, right? Some of the vulnerabilities do require upstream microcode updates, and without them, I feel like the risk introduced outweighs any benefit provided by Libreboot.

</comment></comment></comment></comment><comment><USER7> So far I have heard of maybe one end user with a phone IRL. Are there any examples of non-promoters / paid reviewers / internal employees (like plain ole' end users) showing off the phone?

<comment><AUTHOR> There have been a few reviews popping up. Here are some:

[https://0net.io/1EwAh4KUfGgRw1re7uyrmTUWKZYV9SHVcW/](https://0net.io/1EwAh4KUfGgRw1re7uyrmTUWKZYV9SHVcW/)

[https://www.reddit.com/r/Purism/comments/e2mqgb/i_have_my_li...](https://www.reddit.com/r/Purism/comments/e2mqgb/i_have_my_librem_5_ama/)

<comment><USER3> Also: [https://azdle.net/2019/11/comparing-apples-and- gnomes/](https://azdle.net/2019/11/comparing-apples-and-gnomes/)

<comment><USER8> Can confirm, I am not a promoter / paid reviewer / internal employee.

<comment><USER9> You don't report the weight...

<comment><USER8> My garbage kitchen scale says 231 g.

<comment><USER9> Thank you, good enough!

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> What I find strange that they still don't have specs for the dimensions and weight... That is something they have been very coy about...

[https://puri.sm/faq/index.html#faq- Whatarethephonespecs](https://puri.sm/faq/index.html#faq-Whatarethephonespecs)

<comment><USER11> I suspect this has to do with the current scheme of shipping out the devices in iterative "batches." Presumably they are assuming the early batches will be heavy and clunky, with size and weight of each batch decreasing over time as they learn more about manufacturing.

I find this more troubling than the idea of early batches shipping with pre- beta quality software. At least improvements to software can be pushed out to older devices. If you buy an early batch and get a phone the size and weight of a brick, though, that phone is always going to be the size and weight of a brick.

<comment><USER12> You have to opt in to the early batches and don't they post photos showing how ugly it is? It seems like customers are informed about what they're getting.

</comment></comment></comment><comment><USER13> Nice move from puri.sm

At page 15 and 16 there are some M.2 connectors. One has an USB line named USB2_WIFI_D* and the other USB2_4G_D* so I guess these are used for 2 external radio modules (WIFI/BT and 4G).

I wonder what these modules are. Will it ship with the same from the devkit (RedPine WiFi/BT M.2 module on SDIO, SIMCom SIM7100E)? Pretty important from a security/privacy standpoint.

<comment><USER3> The WiFi/BT module is the same. The modem module is BroadMobi BM818; at later batches there will be an option to get Cinterion PLS8 instead too.

</comment></comment><comment><USER14> Was the title changed to get around this exact story being posted yesterday?[0] This title is wrong and is not the schematics but a blog post announcing the release of the Birch schematics. The correct title is "A Different Kind of Transparency"

[0] [https://news.ycombinator.com/item?id=21690269](https://news.ycombinator.com/item?id=21690269)

<comment><USER15> It doesn't count as a dupe if the story hasn't had significant attention yet. This is in the FAQ: [https://news.ycombinator.com/newsfaq.html](https://news.ycombinator.com/newsfaq.html)

<comment><USER14> Ah, I had forgotten about this. Thanks!

</comment></comment></comment><comment><USER16> Calls don't work yet it seems

<comment><USER17> The reviews said the speaker isn't wired up. I wonder if you can call with the headphone jack?

<comment><USER8> My understanding is that the microphone (& speakers?) isn't wired directly to the modem, but needs the CPU to replay the audio to the modem so that the modem (aka, baseband) doesn't have access to the microphone audio except when it actually needs it. So, I would think that the headphone mic wouldn't work either.

<comment><USER18> This is good for privacy, but can this way of not wiring the microphone directly would also be helpful to do recordings and to send/receive faxes, or does that not work?

<comment><USER8> Normal phones can record phone calls, right? I assume that this wouldn't make anything possible that isn't already possible. But, again, I really don't know what I'm talking about here, this is just my understanding from what I've read.

<comment><USER19> Before I bought a Xiaomi it was impossible to record any call (Samsung, HTC) and it seems it was by design. The only way was installing an app that somehow routed the recording through their servers (no, thanks) otherwise you could only record outgoing (or was it incoming?) sound.

</comment></comment></comment></comment></comment></comment><comment><USER20> Why has it become so acceptable to launch half-baked products that don't actually work? Twenty years ago, you launched a product and it had to work right out of the box. What's gone wrong here?

<comment><USER3> It's a crowdfunded project where some of the backers opted in to receive a device from an early batch. What's so unacceptable about that?

<comment><USER4> And they've been pretty clear that this batch is expected to have issues resolvable in software. I'm sure the audio issue for calls will be fixed in the next few weeks, along with some improvements to battery life and whatnot.

If you don't want a pre-production product, don't opt in for it and wait for Evergreen.</comment></comment></comment>


Airbnb raises $1B to weather the coronavirus crisis - <AUTHOR> https://www.axios.com/airbnb-raises-billion-coronavirus-43745550-2f4b-46ab-8eb0-2d677682751e.html <comment><USER2> Could someone who is working at Airbnb right now comment (anonymously) on the _sentiment_ within Airbnb right now? It is one of the hardest hit companies in tech from a demand standpoint, so your experience will go a long way to help us understand what is going on. Again, not details of the term, just the general _feeling_ .

</comment><comment><USER3> And there I thought the silver lining of corona was air bnb would finally be seen as a large part of our current housing crisis.

<comment><USER4> Airbnb didn't invent the vacation rental. People have rented their place to vacationers since forever. There were and are multiple companies and websites that did that long before Airbnb existed.

Airbnb just made it easier and thus more popular to rent your home or room to travellers.

Airbnb didn't innovate anything in the space as far as I am aware of, except for a great user experience.

The only people to blame in regards to vacation rentals raising housing prices are the governments that set and enforce the rules. As long as regulating authorities allow private residences to be occupied by renters on a short term basis, then investors are going to buy property and rent it that way.

Airbnb's intended usage from the beginning was to rent out the unused value of your home. Which would actually lower housing prices since it allows you to use the housing more efficiently. But now bigger players are buying property for the sole purpose of short term rentals which decreases housing supply.

<comment><USER5> Why would unlocking unused value lower prices? Doesn't make much sense to me

<comment><USER6> If half the houses on a given street have at least one room available to rent at all times, renting a room on that street should be cheaper due to plentiful supply.

</comment></comment></comment></comment><comment><USER7> Although everyone wants to scapegoat AirBnB, interest rates have been historically low for almost 12 years. Reduced interest rates result in increased asset values, especially real estate when long term debt becomes cheaper.

I'm not supporting everything AirBnB does, but blaming them for housing/rental prices seems pretty ludicrous to me. We've experienced real estate bubbles since we started urbanizing.

<comment><USER8> In my eyes AirBnb is being blamed for taking houses off the market that would have generally be rented out to long-term tenants. This lowers the supply of rentals increasing prices. Lower interest rates just make the situation worse.

</comment></comment><comment><USER9> With interest rates what they are right now, I expect a lot more tech companies will look to raise money via debt to build a cushion.

</comment><comment><USER10> They lost $276 million last quarter and still had >$2 billion in the bank. Will be interesting to see if after this additional raise, they have enough to survive the epidemic.

<comment><USER11> I know from personal finance that having a buffer in the bank is good... But this seems to be a rather large buffer.

Can someone please explain what's going on with these numbers?

<comment><USER12> Maybe they're getting ready to acquire some less well-funded competitors who are in financial trouble at bargain rates.</comment></comment></comment>


Steve Jobs - quotes - <AUTHOR> http://en.wikiquote.org/wiki/Steve_Jobs

<comment><USER2> Good stuff:

"When you're young, you look at television and think, There's a conspiracy. The networks have conspired to dumb us down. But when you get a little older, you realize that's not true. The networks are in business to give people exactly what they want. That's a far more depressing thought. Conspiracy is optimistic! You can shoot the bastards! We can have a revolution! But the networks are really in business to give people what they want. It's the truth."

</comment><comment><USER3> It seems simple, but this quote probably had the most profound impact on my life, more than any other quote I've ever read/heard:

"When I was 17, I read a quote that went something like: "If you live each day as if it was your last, someday you'll most certainly be right." It made an impression on me, and since then, for the past 33 years, I have looked in the mirror every morning and asked myself: "If today were the last day of my life, would I want to do what I am about to do today?" And whenever the answer has been "No" for too many days in a row, I know I need to change something." Stanford Commencement Speech, 2005

I still do that every morning.

<comment><USER4> I've always found the idea of living each day[1] as though it were my last to be odd. If I knew that a day was going to be my last, there are potentially fun or useful activities to choose from which carry a very high risk. That day would be the day to do things that have a significant chance of killing you any time you do them... and by "significant", I mean greater than five percent, say, not things like skydiving.

[1] Some versions of this idea use hour, and I've heard someone say "second". How do you live each second as if it were your last? No one who does this would last long; there's no point in doing most of what we do if we're going to die in the next second, right? But maybe people who say "hour" or "second" are just betraying that they don't really mean it.

<comment><USER5> Perhaps you should do the opposite: Live every day as if it was your _first_.

</comment></comment></comment><comment> daniel-cussen I hope someday I too can say, "Because I'm the CEO, and I think it can be done.

        * Time, 2005-10-24
        * On why Jobs chose to override engineers who thought the iMac wasn't feasible."

<comment><USER6> He probably should have fired those engineers immediately.

"Nope, sir. Can't do it. Can't be done. Can't put a computer in a plastic case with the monitor."

<comment><USER4> I suspect we're missing some context. :)

</comment></comment></comment><comment><USER7> Here's that Stanford speech quoted in the article: <http://www.youtube.com/watch?v=D1R-jKKp3NA>

</comment><comment><USER8> "I wish him [Bill Gates] the best, I really do. I just think he and Microsoft are a bit narrow. He'd be a broader guy if he had dropped acid once or gone off to an ashram when he was younger."

</comment><comment><USER9> _You've baked a really lovely cake, but then you've used dog shit for frosting._

I'm sure they are all authentic but that's one I can really imagine him saying.

</comment><comment><USER10> Those product design quotes are fucking great. Read 'em.</comment>


Alert: NPM modules hijacked - <AUTHOR> http://www.drinchev.com/blog/alert-npm-modules-hijacked/ <comment><USER2> There's a lesson to be drawn here about dependency hygiene. On one hand, code- reuse is a good thing, and incorporating other projects by reference is a way to make it happen. On the other hand, each dependency you add creates a little bit of risk: that the package will be updated in a way that breaks your application, or the package maintainer will go rogue, or the package will get hijacked.

Most programming-language communities manage the code-reuse/dependency-hygiene tradeoff by concentrating code into a relatively small number of large libraries, and when people want a function or two that isn't in one of the libraries they're using, they incorporate it by copy-paste. In the Javascript/NPM world, on the other hand, I see a lot of projects with dependency references to huge numbers of tiny dependencies.

Today, we're seeing one of the reasons why that's a liability. Most people will take away lessons about code signing and signatures, and presumably the NPM software is going to be improved in that regard. But the other lesson is that _projects should have fewer dependencies_. Using a library may be as simple as adding one line to a package configuration file, but using a library _properly_ requires substantial due diligence on the library, its license, its bug tracker and its author.

<comment><USER3> No, no. This is about whether people should be able to unpublish from the registry, or how that should be handled since it's problematic in any case.

<comment><USER4> you are part of the problem here. Many folks are refusing to even consider the fundamental issue because it is different from the mindset they are used to.

Yes this particular episode is related to the unpublishing results... however the underlying issue is not only about unpublishing results. The underlying issue is:

number 1, Having thousands of dependencies is a software engineering trade off, their is a upside and a downside of that trade off. Having Thousands of dependencies is fundamentally more 'risky' than have a few. Period. End Of Story. It is ok to accept the trade off based on what you are optimizing for. It is not ok to refuse to accept the fact you are making a tradeoff.

number 2, is you should not be running production builds or builds for important components based on dependencies on the naked internet. This is also an engineering tradeoff but is firmly in the camp of what is considered 'bad practice'. This is fundamentally the same exact underlying reason why we have build servers instead of just builds from developer work stations. Developer workstations are not controlled environments, which means the builds are not guaranteed repeatable. A build server that depends on the state of the naked internet is not a controlled environment. It blows up today because of unpublishing, it will blow up tomorrow because of something else.

<comment><USER5> I agree with what you're saying. But I think the "grand experiment" of npm and modern javascript development is to go "all in" on the "lots of small modules" approach. Having many small dependencies is, and always has been, a trade off. The question is how far can we get optimising away from the pitfalls, while still retaining the benefits?

I think it's a worthy exercise, since the prize is no less than efficiently distributing coding effort across the globe.

Problems like we've seen today are a double edged sword. On the one hand they're troubling, but it'll focus the community on the problems, and hopefully npm will make a few changes too.

> A build server that depends on the state of the naked internet

Whether npm based or not, don't the vast majority of build servers, for whatever language or platform, rely on the state of the naked internet? Whether that's downloading binaries, compiling from source, or whatever?

<comment><USER6> Your build servers shouldn't really be exposed to the public internet, best practise would be to get all dependencies/binaries of a local network.

</comment></comment></comment></comment></comment><comment><USER7> I've been on the receiving end of a NPM name dispute violation handed down by Izs. [https://docs.npmjs.com/misc/disputes](https://docs.npmjs.com/misc/disputes)

Was on vacation and found out that I had lost a published package name within 24 hours of the dispute request. Broke a few production systems. Really messed up my day.

Ended up having to beg with the person who filed the original request and they eventually gave me the package back.

Honestly, the whole process was a bit personal and I felt like I was being singled out as an individual by NPM, rather than being treated like a developer who was using the service. Not a nice feeling.

</comment><comment><USER8> It's insane that NPM allows anybody to just take over a module name if the original is unpublished, without even a warning to users.

<comment><USER9> Insane, yes, but I guess it's just never really been that much of a problem until now. Hopefully something good will come out of this..

<comment><USER10> You would think this is part of security 101 for these things...

And people wonder why big enterprises are scared of touching open source stuff.

<comment><USER11> > And people wonder why big enterprises are scared of touching open source > stuff.

 _some_ open source stuff. Most enterprises dig distributions, especially with LTS.

</comment></comment></comment></comment><comment><USER12> Edit: I'm definitely wrong. The person who published these was merely parking the packages. Leaving the existing (inaccurate, see response) message as one example of how badly this could have turned out.

 _> and the content of the files is suspicious_

The script seems as though it might publish your entire codebase to NPM. Sorting NPM packages by creation date[1] reveals[2] a[3] few[4] potential victims. Filtering by the ISC license also seems to work.

[1]: [https://libraries.io/search?order=desc&platforms=NPM&sort=cr...](https://libraries.io/search?order=desc&platforms=NPM&sort=created_at)

[2]: [https://libraries.io/npm/alaska-dev](https://libraries.io/npm/alaska- dev) \- internally hosted repo, edit: license doesn't match other projects by the same developer

[3]: [https://libraries.io/npm/b3app- prototype](https://libraries.io/npm/b3app-prototype) \- private bitbucket repo, edit: deleted from npmjs

[4]: [https://libraries.io/npm/nodework](https://libraries.io/npm/nodework) \- private bitbucket repo

<comment><USER13> Installing one of these packages doesn't execute the script though, you'd have to do that yourself. (It could be updated to do that though, which is terrifying.)

<comment><USER12> I wonder if the author is possibly proving a point. Regardless, it seems as though having an NPM user set up on your CI server is a big risk.

<comment><USER14> You have to have an NPM user setup on your CI server in order to use private NPM packages, which some companies do instead of hosting their own onsite NPM.

</comment></comment></comment></comment><comment><USER15> As shitty as unpublishing is, I think the best thing the npm community needs to take away from this is auto updating is bad. Remove the ~ and ^ from your dependencies so that only a package of a specific version can be installed. "This or better" thinking doesn't work if "better" is unknown. I know that the version I am using currently is fine but I don't know about future updates. Even if we had signed packages, we are still installing unknown software if we just trust other devs. I lock my dependency version and then use [https://www.npmjs.com/package/npm-check- updates](https://www.npmjs.com/package/npm-check-updates) to figure out what needs updating, then I test my code. This should not be done as an automatic part of the build process.

*edited npm capitalization

<comment><USER16> Dependency version ranges should be a _wide_ as possible, so that users of your libraries have flexibility when selecting versions.

Rather than artificially constrict your version ranges, NPM should support real version locking, and applications should check in their lock file.

<comment><USER15> Known ranges are fine. e.g. It is fine to accept known published versions 0.0.1 to 0.0.4, but not unknown future versions 0.0.5 and up, which ^ and ~ allow.

</comment></comment></comment><comment><USER17> I challenge someone to tell me the difference between npm and an RCE.

"npm" is two things in this picture: the server and centralized service, and the software tool on everyone's build/dev machines.

Folks have historically been happy trusting the centralized npm server to behave consistently and pleasantly, and some opinions have recently shifted on that. But frankly, the server doesn't matter, in the big picture. The npm tool on your computer does. It's the one _executing code on your computer_ with all of your local user's privileges.

This tool starts executing new code from a new author on my host as my user without any authentication except "trust the server". This is exactly the same words we would use to describe behavior of $script_kiddie_virus_of_the_week:

> "download code from C&C server; run it, thanks:D"

What's the difference here? "good intentions"?

I'd rather have something more than "good intentions" controlling what code ends up running on my computer. Wouldn't you?

</comment><comment><USER18> Author of the post here. According to a tweet [1], the user @nj48 seems to be non-malicious.

I updated the blog post.

Nevertheless I find his actions dangerous and irresponsible.

[1] [https://twitter.com/seldo/status/712673227630313472](https://twitter.com/seldo/status/712673227630313472)

<comment><USER19> Curious, should those of us using their Linux PPAs disable them until this is sorted? The idea of re-using disabled package names is out there now and I wonder how long it is before someone malicious tries this. Is this an unreasonable concern?

<comment><USER18> Not sure about that. I'm away of the PPA's + NodeJS's NPM packaging model.

</comment></comment></comment><comment><USER20> For those of us who are pissed that this is going down but need the status to get on with our lives:

nj48 is a known friendly who has identified himself to us. We're going to clarify later today.

[https://twitter.com/seldo/status/712673227630313472](https://twitter.com/seldo/status/712673227630313472)

<comment><USER21> I bet the orig dev was considered a known friendly until he decided to unpublish.

Relying on the notion of a "known friendly" to protect packages and namespace does not strike me as a sound practice.

As others may have mentioned, publishing packages really should be fire and forget. If something bad goes out, a replacement should be sent out. And for the life of me, I don't understand why they did not go with the <author/package> scheme.

</comment></comment><comment><USER22> It's worth noting that the official NPM dispute resolution policy makes the following very clear ([https://docs.npmjs.com/misc/disputes](https://docs.npmjs.com/misc/disputes))

> Some things are not allowed, and will be removed without discussion if they > are brought to the attention of the npm registry admins, including but not > limited to:

...

4\. "Squatting" on a package name that you plan to use, but aren't actually using. Sorry, I don't care how great the name is, or how perfect a fit it is for the thing that someday might happen. If someone wants to use it today, and you're just taking up space with an empty tarball, you're going to be evicted.

5\. Putting empty packages in the registry. Packages must have SOME functionality. It can be silly, but it can't be nothing. (See also: squatting.)

</comment><comment><USER23> Looks like the author of the modules wrote a shell script to generate a package.json file and publish empty modules to npm to grab up all the unpublished names. However, when they ran it, they ran it in the same folder with their shell script and list of available modules and `npm publish` included them in the published modules as it does by default.

</comment><comment><USER24> A big problem with Software repositories that don't allow for /enforce cryptographic signing by the developer is that this can happen...

Ideally the developer would sign before publishing and the consumer could check the signature to validate before using.

Whilst not a silver bullet this is a kind of essential part of a secure package management solution.

<comment><USER25> Plenty of repositories require signatures.

<comment><USER24> for NPM? As far as I'm aware it's not even an available feature. None of rubygems/PyPi/NuGet require digital signatures...

What repositories were you thinking of that do require that?

<comment><USER25> NPM doesn't. Maven does. Debian has authentication of the repository itself.

<comment><USER26> yep the linux repositories are generally way ahead of the programming language lib ones in this regard (evidently with the exception of Maven), one of the reasons that it's a shame to see newer ones not learn the lessons that previous repo's have on security

</comment></comment></comment></comment></comment><comment><USER27> Overly dramatic. The content is not suspicious at all, it's clearly a script to generate the package.json for an arbitrary package name passed in as an argument to the script.

I'm guessing @nj48 used a script to go over the official list of unpublished modules and attempt to generate a placeholder for each of them.

The same user also published some actual (unmanipulated) forks of the original modules, so I'm guessing this is mostly a quick move to preempt any malicious hijacking by others.

There is no reason to assume the "hijacking" is malicious. Certainly not in the scripts. The user is active on GitHub and shows no indication of malicious intent.

However it IS worth pointing out that the unpublished modules should now be treated with caution if you still rely on them because even if the replacements are identical and benevolent you probably need to take action.

<comment><USER28> > a script to generate the package.json for an arbitrary package name

Yep, that and it ___publishes your project to NPM!!!_ __

edit: I was wrong, the x.sh script looks malicious but appears not to be? In any case it shows that installing NPM modules is just as unsafe as 'curl | sh'.

Ways to be safe are to first check what scripts will be run by a package: 'npm show $MODULE scripts'. There is also the '\--ignore-scripts' flag[1].

[1]: [https://blog.liftsecurity.io/2015/01/27/a-malicious- module-o...](https://blog.liftsecurity.io/2015/01/27/a-malicious-module-on- npm)

<comment><USER29> _If_ you're logged in, _if_ you call it with an argument that isn't already in use as a module name, and _if_ you specifically enter the full path to the script (you don't have cwd on your $PATH, do you?). TFA would make more sense if it contained a warning not to run random scripts that one downloads without reading them.

As it is, TFA seems like an attempt to invent malicious rumors about a completely innocent person.

[EDIT:] you're still wrong; in order to be equivalent to "curl | sh", x.sh or its equivalent would have to be referenced in the "scripts" object in "package.json".

</comment></comment></comment><comment><USER30> There are some very shaky bits in the JS dev arena. Just a little earlier, we read about how a developer unpublished his libraries from NPM, the fallout from this affected numerous high profile projects like node.js, which were relying on a left pad "library" that basically was a small string padding function.

<comment><USER8> This is the same story... It's a module that the developer unpublished

</comment></comment><comment><USER31> Noticed another random package was uninstalled from NPM. Please oh please don't let this thing become a trend.

</comment><comment><USER32> Sorry but the elephant in the room IS the lack of namespacing. There is no namespacing on NPM. If there were something like that this issue would have never happened. This is not a problem of distributed vs non distributed, NPM doesn't need a "blockchain" or whatever. Packages SHOULD by namespaced period and any serious package manager uses namespaces. I (and many others) called it from the very beginning and warned NPM authors that the lack of namespace would eventually lead to this kind of issue. NPM authors didn't give a damn ( there are other issues that have been known for years but they fell on deaf ears ). Packages should be resolved by a namespace + the name of the package. Now everybody is in panic mode because nobody knows what one is fetching from NPM anymore.

Now I hope NPM author will come to their senses and change the way NPM works. But the trust is broken, no question. Between stuff like that, people selling "realestate" on NPM for real money... Nodejs has been the least professional platform I have ever used. Everybody's out there to make a quick buck, nobody gives a damn, this is whole thing will collapse sooner or latter.

Finally people need to stop with the "unix philosophy" excuse. Importing 10 lines of code from a random package is not the "unix philosophy". Splitting a 100 loc module into 20 packages is not the "unix philosophy". Packages have so many dependencies it's getting ridiculous.

edit: corrected

<comment><USER33> Sorry, 100% agree with you but with your life going forward, it's "fell on deaf ears"

<comment><USER32> Oh, sorry, I'm not a native English speaker so yeah I tend to make stupid mistakes like these.

</comment></comment></comment><comment><USER34> Name squatting in those package managers is a real problem. I found this on pypi and it was a very unpleasant surprise. [https://sourceforge.net/p/pypi/support- requests/571/](https://sourceforge.net/p/pypi/support-requests/571/)

</comment><comment><USER35> In the root project folder (containing package.json and ./node_modules), you can run the following:

        comm -12 <(ls ./node_modules) <(curl https://gist.githubusercontent.com/azer/db27417ee84b5f34a6ea/raw/50ab7ef26dbde2d4ea52318a3590af78b2a21162/gistfile1.txt)

It will output any of the modules that @azer unpublished yesterday (that are being used by your project).

<comment><USER35> NOTE: this only works for NPM 3's flat node_module structure

</comment></comment><comment><USER36> Anything wrong with checking your dependencies into your repo? That way, you know, they can't go away or be hijacked.

</comment><comment><USER37> As a rule of thumb, if a dependency would take you less than two days to rewrite (one day for writing, one day for testing), it's better to do it yourself and avoid the problems of dependencies.

<comment><USER32> How many nodejs developers actually audit their dependencies ? In my experience not many. it's just "npm search" without thinking. then "my problem is somebody else now". Frankly the whole ecosystem is just scary.

</comment></comment><comment><USER38> PSA: you should be keeping your dependencies in git

<comment><USER39> Bundling is _not_ the answer.

<comment><USER40> It worked for me. After countless injections of errors after updating a large list dependencies we made the decision to stop updating and freeze the versions, patch remaining errors ourselves and leave it alone. Worked so well we now have time to rebuild the whole front end on a new stack as an experiment instead wasting time with endless bug hunts.

<comment><USER39> Maybe bundling is fine for your in-house proprietary software, but it's absolutely not OK for free software where users and administrators _need_ to keep on top of things like security updates. When projects bundle their dependencies, users become dependent on that project to provide critical updates to software that the project didn't even write. This multiplies for each piece of software that bundles their dependencies. It's simply unsustainable and irresponsible.

<comment><USER40> I agree. Someone making free OS software for others to use shouldn't bundle.

I made the assumption on the top post that they were in-house proprietary software given the reference to keeping everything in git.

<comment><USER39> I guess we're on the same page! Sorry!</comment></comment></comment></comment></comment></comment>


How the Sun Sees You - <AUTHOR> http://www.thisiscolossal.com/2014/08/how-the-sun-sees-you

<comment><USER2> This exploits a well-known fact about lighting -- someone illuminated by blue or violet light looks terrible, while someone illuminated by red light tend to look better than they do under white light. This is why experienced photographers, shooting monochrome film and intending to flatter their subject, will use a red filter.</comment>


What do you think of these names for a monitoring platform? - <AUTHOR> I'm launching a startup in the fintech landscape. My startup intend to be active in africa where fundraising and revenue generation can be tricky. I'm currently setting up a monitoring service based on grafana+graphite+prometheus/telegraf that i'll also provide as a service to other startups (either local or international).
I was looking for a name for this service. So what do you think of : - perfmonkey
- hackstream - streamstow
PS: your ideas are welcomed too and by the way I'm looking for a co-founder that want to change banking and financial transaction in Africa :) <comment><USER2> Stream Stow is the best of the group you have there.

Leave the monkeys and hackers out of a serious startup :)

<comment><AUTHOR> Thank you. I'll keep that one. Still looking for something better ;)</comment></comment>


PHP JSON removed in PHP 5.5 - <AUTHOR> http://iteration99.com/2013/php-json-removed-from-php-5-5/?utm_source=buffer&utm_campaign=Buffer&utm_content=buffer6f958&utm_medium=twitter

<comment><USER2> I don't think the title is correct: JSON being pulled is not mentioned in [http://php.net/manual/en/migration55.changes.php](http://php.net/manual/en/migration55.changes.php)

It is probably the case that in common Linux distributions, the build of PHP has the relevant functionality removed, as the license does obviously conflict.

It's a shame that only IBM gets dispensation to do evil :(

<comment><USER3> Here is a better summary of the situation: [http://liorkaplan.wordpress.com/2013/06/01/bye-bye-non- free-...](http://liorkaplan.wordpress.com/2013/06/01/bye-bye-non-free-php- json-extension/)

<comment><USER4> Thanks, that cleared things up quite a bit. It seems that it is isolated to Debian unstable. Even that problem should be resolved soon through an alternative JSON extension.

</comment></comment></comment><comment><USER5> This all boils down to Crockford being intentionally annoying about the licensing.

Video here: [https://www.youtube.com/watch?v=-hCimLnIsDA](https://www.youtube.com/watch?v=-hCimLnIsDA)

<comment><USER6> It would probably take at most a few hours to rewrite a JSON encoder and decoder. It's hardly a complex piece of code is it.

<comment><USER7> Not to mention the hundreds of third party json PHP classes.

</comment></comment></comment><comment><USER8> I call B.S. No way they are removing json_encode/json_decode from php. That would essentially be removing an extremely high-volume method from the php stack.

<comment><USER9> I second your call. That would be a completely insane move!

</comment></comment><comment><USER10> I'm seriously torn about this. On one hand, of course, Debian is kind of right in their assessment and strictly speaking, the JSON extension and with that the PHP package is not entirely free software.

On the other hand, the risk of anything bad coming out of shipping code with this license (evil people will have no qualms violating the license :-) ) is very close to zero. However, the risk of people being seriously pissed off at the next version of Debian (or Ubuntu) breaking all their web applications is really high.

Yes, an alternate extension is starting to exist, but it might either work subtly differently from the built-in one (you know, bugs exist and people might depend upon them), or worse, might have security flaws remaining undiscovered due to fewer eyes reviewing the much smaller in scope extension.

This is not just bad for users, but also for developers of libraries who now have to take extra care to support the other extension.

It's ridiculous to having to go through all this trouble for some evil people to be able to use Debian :-)

Thank god I moved to packaging and deploying our own PHP for our application. Having to deal with a non-standard JSON extension for no reason but politics and lack of pragmatism would piss me off endlessly.

That all said and after having vented my frustration: I still see where Debian is coming from and I can also kind of understand their decision. Of course it still pisses me off, but I can understand it.

Maybe Debian (and by extension Ubuntu) just isn't the right distro for me. Though seeing that the replacement extension is made by a Fedora developer, I seem to be running out of options :-)

<comment><USER11> > Debian is kind of right in their assessment

There really isn't a 'kind of right' here, it is either Free (which Debian clearly defines) or it is not. It is not, so it has got to go.

Debian doesn't care about 'people being pissed off' because they are a non- commercial distro that is committed to staying 'Free'. Principles are what the whole project is about.

This is the type of thing that happens when you try to be cute with something that has a legal meaning.

</comment></comment><comment><USER12> Short summary, JSON is not removed from PHP. Some distros of Linux (specifically mentioned were Mandriva/Fedora/Debian) have replaced the version written by Crockford with another alternative: jsonc

</comment><comment><USER13> 404 link is quite the coincidence.

<comment><USER14> It actually timed a little while ago.

</comment></comment><comment><USER15> Apparently the reason for this is the "Software shall be used for good" clause in the license, but I believe IBM obtained a special exemption that it may be used for evil as well.

Surely, the PHP folks can acquire a similar variation?

<comment><USER16> Nope: Crockford has been asked and declined, per [https://bugs.php.net/bug.php?id=63520#1352964601](https://bugs.php.net/bug.php?id=63520#1352964601).

</comment></comment><comment><USER17> Reading the comments to the PHP bug, I find it funny that "The Software shall be used for Good, not Evil." license clause was _not_ approved by Google :) :) :)

</comment><comment><USER18> The link is 404 so In layman terms, unless some other extension comes up with exact same function names, my json_encode/json_decode will stop working in 5.5? fuck.

<comment><USER19> Only with the version included in the Debian repositories.

</comment></comment><comment><USER20> 404 link :/</comment>


Yahoo just pulled the plug on its Google-like research group - <AUTHOR> http://www.businessinsider.com/yahoo-labs-to-integrate-with-product-groups-2016-2 <comment><USER2> People in R&D are different than your frontline engineers. I'm not sure putting them in the same team is going to make either one happy. Would be interesting to see how this plays out.

I expect more costly departures for Yahoo.

</comment><comment><USER3> This is when Marissa thinks it was a mistake to accept that job offer as a CEO of Yahoo.

<comment><USER4> I'd sell my reputation as a business leader for $100 million.

Just let me know.

<comment><USER3> You are right but you can choose better opportunities to waste your reputation.</comment></comment></comment>


Rust web framework, Iron - <AUTHOR> http://ironframework.io/ <comment><USER2> The first thought that should pop into your head is probably, why use this instead of language XYZ, where XYZ is Ruby/Java/Python/Go. It's actually a pretty interesting question because Rust is very much unlike those languages in the sense that it's a true systems programming language like C/C++ are.

No one would (should!) ever consider writing a webservice in C++, simply because it's unsafe to do so, it's much easier in other languages and the performance downsides of those languages don't matter any way (i.e. Ruby powers a bunch of high throughput websites yet it's notoriously 200x slower than any other language).

But here comes Rust, it takes away the unsafety, arguably being even safer than the managed languages in some aspects, is (in most aspects) easier to use than C++ (coming close to the managed languages in ease of use), yet has similar performance aspects (theoretically identical performance aspects) to C/C++.

There's a web gateway in our cluster that receives binary blobs over REST and puts them onto the message queue. In total not much over 100 lines of Ruby. We've thought about reducing the server load a bit by porting it to Go or some other more performant language. We probably wouldn't go for Rust, since Go is simply easier to learn (should a new person ever have to perform maintenance). Just the possibility of implementing it in Rust in roughly the same timespan and code complexity while having a theoretically optimal performance is very interesting.

<comment><USER3> I can write web services in Haskell, OCaml, .NET, Java, Ada, Delphi, D, Go.

All compile to native code and I don't have to fight with the borrow checker.

Rust needs a good story to be sold as alternative for web development.

We don't need system programming features in a web application. Unless maybe when offering a web interface to an embedded device, instead of coding it in C.

EDIT: Before the downvotes continue, I am not attacking Rust and feel it is good that it also gets web frameworks.

The point being that for web development there are already better alternatives and unless one needs Rust special language features, there isn't a compelling reason to use it instead of the more mature alternatives which also make use of native code.

<comment><USER4> The borrow checker also eliminates data races (and a variety of other bugs), something that most of the other languages on your list do not. While avoiding GC is probably the most prominent reason for the borrow check's existence, it is not the only one. You shouldn't have to fight with it.

(Haskell in particular has a much more restrictive borrow checker than that of Rust: purity.)

<comment><USER2> As a Haskell programmer I feel this isn't exactly true. Haskell's garbage collector and referential transparency make immutability not really an issue. Impure code is simply of a different type, so it's easy to avoid. What makes dealing with the borrow check hard is that it triggers on code that intuitively is correct, it can be hard to envision why it's not. I feel Haskell does a better job at diverting you from incorrect code.

That said, dealing the borrow checker is just a skill. You take out a few hours to learn to deal with it, and then you just can. As you said it's super powerful and definitely your ally, so saying its a downside of Rust is silliness.

<comment><USER4> > What makes dealing with the borrow check hard is that it triggers on code > that intuitively is correct, it can be hard to envision why it's not.

Because it's more expressive than just forbidding mutability. You _could_ program in Rust the same way you program in Haskell, by encapsulating mutability in functions with different types (&mut). Then the flow sensitivity and other issues would never bother you.

Rust's flow-based control of mutability is strictly more expressive than the monad system of Haskell. If you don't like that expressivity, don't use it.

</comment></comment></comment></comment></comment><comment><USER5> Main author of iron here, on mobile but happy to answer any questions.

Here's a link to the first chapter of an iron tutorial I've been working on, which explains the "hello world" example in great detail and introduces some of irons core abstractions: [https://github.com/iron/byexample/blob/master/chapters/hello...](https://github.com/iron/byexample/blob/master/chapters/hello.md)

<comment><USER6> Thanks for all the work on iron / hyper / web-related rust! You've done some impressive amount of coding!

I was wondering what are your plans regarding iron-related extras. It seems like logger, staticfile, and others are not updated as often as iron itself (some fixes I noticed lately were PRs, staticfile fails on travis). Do you have plans on how to expand iron in the future? Will you produce more basic blocks yourself, or do you expect some community modules to start growing as people use iron itself?

<comment><USER5> I try to maintain and ensure the basic building blocks are usable and high quality, but I am just one person, and there is much to do. There are several other people associated with iron who also help with maintenance and feature additions to the key packages under the iron organization, and they make everything much much easier (thanks again!).

There are already some community crates that integrate with iron, providing things like handlebars templating; I hope that as the community expands, more third party crates will appear and make using iron even easier.

If anyone is interested in working on iron or wants to write a community crate using it, you should reach out on the #iron channel on the Mozilla IRC network. I and others hang out there and we can answer questions and provide help.

</comment></comment></comment><comment><USER7> Crates.io uses Rust as a backend, Ember on the front. It uses about 35MB of resident memory, and (other than some weird DNS issues that aren't the server's fault) is just super rock solid. (It doesn't use Iron, though.)

I'm still not sure the application tier isn't best served by something that's easier to prototype in, but if you already know Rust, the web stuff is shaping up pretty nicely.

We also got Hyper, Iron, and Nickel entries into the Techempower benchmarks, I'm really interested in seeing the eventual results.

<comment><USER6> Just curious - what are you using on the backend? From-scratch rust code?

<comment><USER7> [https://github.com/rust-lang/crates.io](https://github.com/rust- lang/crates.io)

It uses 'conduit', which is a web framework that's basically only used by crates.io, as far as I know.

<comment><USER8> We use conduit at Dropbox as well, but mostly for PEP 333 type reasons ("universal" request/response types and a pluggable coupling layer between handlers and servers.)

<comment><USER7> Ah, neat! Thanks for filling me in. I almost never hear people talking about it.

</comment></comment></comment></comment></comment><comment><USER9> Warning: very little knowledge of Rust and Iron

Can someone explain why there is an extra Ok(...) in this? (I want to call it a function, but I'm not even familiar enough with Rust to be sure that it is a function).

Is it something that could be removed? Right now it just looks like boilerplate.

Edit: Thanks everyone! Ok is similar to a Right or Success of a Either/Result type of object.

<comment><USER6> You mean in the handler? The return value has to be of a type `IronResult<Response>`. That means it can be either `Ok(...)` for success or `Err(...)` for failure.

In other languages/frameworks (python/pecan for example) you'd throw an exception in case of things going wrong. In Rust exceptions are for very exceptional things only (it's called panic). So the more calm way is just to return `Err(...)`.

It's not a function, it's more like a tagged union (in rust called an enum). So in practice it's like C's union, but you do know which member was chosen and only that one is accessible.

<comment><USER10> Small correction: Rust doesn't have exceptions. panic!() crashes the current thread with an optional error message, but it doesn't do stack traces and there's no try/catch in the language (there's the try!() macro, but it works with Result<T, E> values, has nothing to do with panics).

<comment><USER11> It records stack traces. Use the environment variable `RUST_BACKTRACE=1` to print them.

</comment></comment></comment></comment><comment><USER12> Every time I see new languages and frameworks being used for web applications I get scared.

One reason I am super gung-ho about Golang for an API or website, is it came with the net httplistener package, html/template package, and has several fairly well made open source packages (and standard packages) for secure sessions, CSRF tokens, output filtering, shelling out, so much more...

Without these types of features, people are doomed to build web-apps no more secure than everyone's first, broken, PHP webapp.

I'm not sure what the purpose of a truly system's oriented back-end is similar to this[0], it kinda of scares me. Some have mentioned for embedded systems. I don't know if people are using rust in embedded systems yet. But please be aware of just how wild-west writing a full webapp or API with this would be.

[0] - [http://www.gnu.org/software/libmicrohttpd/](http://www.gnu.org/software/libmicrohttpd/)

<comment><USER4> All of the features you mentioned have Rust equivalents in the crates.io ecosystem. So what in particular do you prefer about Go?

<comment><USER6> What's the CSRF library? I couldn't find one on crates.

<comment><USER4> Yeah, I guess crates.io is missing that one. It should be straightforward to write though.</comment></comment></comment></comment>


Ask HN: When did you realize your passion for programming? - <AUTHOR>

I'm wondering because it seems to have a considerable barrier to entry, at least compared to other less intellectually rigorous fields.<p>So what was the turning point that made you realize that you had a passion for the hacker lifestyle? Or was there no distinct point in time, just a gradual increase of interest? <comment><USER2> I started as a cracker. I cracked sharewares and games for all the kids in school and was somewhat sought after. I ruled the schools' Novell LAN with an iron-fist and a well-stocked boot floppy. Sure, I was mostly more talk than walk, bragged a lot; but on several occasions, I was able to pull off some stunts before a thankful audience of "cool kids" (you're welcome, Imran ;-)

But as I got better at reversing, I needed more sophisticated tools, and I needed to write them myself.

I usually did my cracking on request, cobbled up something quickly before class or early in the evening, and took floppies of keygens and patches with me to school in the morning. I wasn't exactly a jock, but I was cool; had gelled hair, baggy jeans, a walkman, wore sunglasses in class, etc. Pretty much riding on Neo's coat-tails, thanks to the then new movie, The Matrix.

But I distinctly remember one winter when I didn't give a shit anymore. I was developing my own x86 disassembler and had hand-written opcode tables on my wall. I remember waking up later and later for school, not bothering to dress, avoiding friends, and refusing to take crack requests.

I pretty quickly out-grew all my familiar tools and techniques. The official Microsoft and Intel documentation wasn't cutting it. I was fedup with crap "popular opinion" in the assembly-programming fora. I realized all the crackers and black-hats were mostly full of shit and didn't know what they were talking about. I "felt" my tools were primitive, and there was more to life than mastering the quirks of crappy compilers and assemblers from MS or Borland. I had just watched my treasured knowledge of MS DOS go obsolete, none of the old tricks worked.

So I bought myself a bootleg, Xerox copy of the Dragon Book. Soon after, Tanenbaum's OSD&I.

Boy met theory, and boy had to grow up fast.

I realized I loved programming when I no longer did anything else :-P

</comment><comment><USER3> For me the turning point was when I realized that programming gave me a nearly infinite budget in terms of logic components that I could re-use without desoldering the circuit boards again. Before then it was all 74 series logic ICs and lots of scratching to break traces on pre-etched boards or routing my own boards with tape. Software is so much less messy, and you get to improve the end result without having to turn that neat board in to an ugly one, when it's done you can't tell how much it was 'refactored'.

It also saved a lot of money in parts, and when you're on pocket money and in to electronics a computer is actually cheaper in the long run (even if the up- front was substantial for me at the time, from my news paper route).

</comment><comment><USER4> In 2-3 grade, my tiny little school had a single computer. It was a DOS-system (circa 1989) and although it was cool, we were only allowed a few minutes of strictly monitored time on it and even then, it was pretty limited.

The next year, I switched to a much larger school and was enrolled in Gifted class - where they had a Mac with HYPERCARD.

The whole Mac + HyperCard experience was mind blowing. Technology went from something of limited use that I was afraid of, to this amazing thing you create with (back then, even changing the desktop icons was a creative art).

The Gifted teacher let me take the 500-page HyperCard manual home and that's pretty much where I lived for the next few months. A few times a week she would come get me from normal class where I would then, after sludging through her regular assignments, get 10-15 minutes to type out my experiments and ideas.

Til this day, I'm still just that little kid pounding on a keyboard. :D

<comment><USER5> You just reminded me of my own awakening with hyper card in early high school. Until reading this, I considered my first "wow, this is awesome" experience with programming was simple VB6 apps in late high school. Hyper card rocked my world.

</comment></comment><comment><USER6> When I entered high-school at the age of 12 (15 years ago) someone in class showed me how to draw circles on a screen with QBASIC. I was instantly hooked.

        SCREEN 12
        CLS
        CIRCLE (320, 240), 100, 15

<comment><USER7> Reading this gave me the biggest involuntary grin I've had all week. QBasic was my gateway drug, too.

</comment></comment><comment><USER8> In high school I programmed a 1337-speak translator, a hardy-weinburg equilibrium simulator, and a spaceship game. I really loved building things.

But then in college I stopped programming for whatever reason. I guess I didn't think it would make a good 'career'. This was a huge mistake. I got a lot of advice near the end of my education to get a job that I was passionate about, where what I would be doing was something that I would do if left alone.

I looked back at my life and one of the biggest things I enjoyed doing was programming those little applications in high school. All of that programming was entirely on my own and it was one of my favorite things in school.

So, about 3 months ago, I decided to get back into programming and have been working a few really fun projects, including an API for the Stanford Parser <http://nlp.naturalparsing.com>

Lessons learned:

1) go after what you are passionate about (obvious)

2) its not always too late to pursue your passion and learn new things (not always obvious)

</comment><comment><USER9> My passion for programming peaked in middle school. I'd pull all nighters building cool little apps in Visual Basic. I was just amazed I could build _real_ apps that kinda behaved like other commercial apps.

Few months into high school, I started getting requests for contract work on RentACoder, a site launched by code sharing site planet-source-code(where I had a lot of submissions). I still loved programming. But overtime, I became a lot more conscious of the $ amount and optimizing for making a business versus learning programming.

Nothing bad, but my passion just diverged significantly. I went from being the guy who told his first dozen clients he didn't care for the money and probably worked at a dollar an hour for many of the initial contract projects...to a guy who was hiring full-time dudes offshore so I could maximize rev.

</comment><comment><USER10> When I was 8 or so I found a book in my school's library about making computer games with BASIC. I tried some of what I learned from the book on our home computer, and after running into some problems, I asked my brother for help, and soon discovered that all of my brothers and my father had done the same thing, and they were all anxious to teach me what they knew. We emigrated and bought a new computer, and my new school didn't have any books on programming and our new computer didn't come with BASIC, and so for my birthday I got a set of C/C++ compilers and some books. Now it's my career!

</comment><comment><USER11> I tried to recreate SimCity and ActRaiser in BASIC using ASCII graphics when I was a kid. My parents bought us a good computer, but would almost never buy us games. (I played these two games at a friend's house.)

Trying to recreate SimCity was the perfect thing for a 13 year old to do because it really gets your brain around modeling complex systems -- and sets the stage for OOP -- even when you fail miserably. :-)

Later my interest was rekindled in college when I tried to create a neural network in Java from scratch. Again -- failing miserably and enjoying every second of it.

</comment><comment><USER12> When I was 12 someone gave me a very old Z-80 machine. The only disk I had for it with a programming language on it was dBASE II which supported scripts, but the computer also came with a very thin, informally written dBASE II programming introduction. Although for a proprietary database script language, the author of the book (alas, I cannot remember the author's name) did a remarkable job of introducing basic structured programming concepts like loops and select statements.

I did not so much learn from the book as experience a cascade of Earth shaking revelations from it; it was as if each concept were something already wired into my brain, and the words from the book activated mental subroutines that were waiting to be awakened. (This makes more sense if I point out that I had spent every waking moment since about age 6 up to age 12 obsessively trying to work out in my head how computers and programming worked without actually having access to a machine (my family was too poor to afford a computer in the 80's) and so reading the book was a process of discovering vindication of things I'd only been able to speculate about.)

</comment><comment><USER13> My neighbor got a Comodore PET around Christmas of 1979. I was 11, and I knew the minute I saw it that I wanted to know everything about it. When my neighbor wasn't home, I would sneak into their house via a basement window, and teach myself BASIC by typing in programs from various magazines. A few years later, I convinced my parents to buy me a Comodore 64 for about $600. This was a ton of money back in the day, it was more than our family's color TV cost.

When I got to college, I wanted to be a Electrical Engineer, just like my neighbor, but I didn't do well my first semester. I switched to computer science because it was easier. 3 years later I was porting VAX Fortran to a Cray YMP and couldn't believe that people were paying me to do it. I would have happily done it for nothing, just for the chance to run code on a Cray.

</comment><comment> j-g-faustus I was interested in computers around age 17 (when I attended a vocational electronics school in the mid-80s), we made simple circuits and a few simple programs in Basic.

I got more interested in my early twenties, a friend of mine was a programmer and the computers an individual could afford became more powerful. (I was never very interested in Commodore 64 and its ilk, they seemed too constrained to be useful.)

I started programming in my late twenties, when I attended university and got a CS degree.

I'm not still not entirely sure that I have a passion for the hacker lifestyle. My view today is the same as when I was a teen - computers and programming can be very useful tools, but I find tools interesting only to the extent that they can help me solve an interesting problem.

</comment><comment><USER14> When I started writing VBA macros for excel spreadsheets at work. The gratifying thing was that dozens of people were immediately using the things I built and productivity was measurably increasing - while not having to worry about rigorous testing or anything like that. Someone on an excel help forum had told me I'd need to use VBA to do what I was originally asking, and when I did I seemed to... Excel myself.

I'd been primed by some brief previous experience programming in one year of highschool and when I was a kid with a ZX Spectrum. Not sure why I didn't get 'the bug' earlier. Probably lack of extrinsic motivation.

</comment><comment><USER15> I would say that it was in 1969, although I wrote my first program in 1964 or 1965.

When I was a soldier in the USArmy I spent the latter part of my enlistment as an assembler programmer on a UNIVAC 1005 computer (4K memory, 80 column cards, ...). At some time during that experience I decided that when I got out of the Army (in 1971) I would go to school on the GI Bill and study computer science. That's exactly what I did.

I have been programming professionally since I graduated from UMASS, Amherst in 1974. If I have my way I will never stop programming.

</comment><comment><USER16> When I was a kid I played with lego's. I followed the instructions line by line, never missing a step and making an exact replica that was on the box :) Programming in it's simplest form.

</comment><comment><USER17> In typical girl style I'll say that I never realized I had a passion for the hacker lifestyle. In fact, if I think about it explicitly, I eschew it. It's rather that I've fallen into it by being good at programming, enjoying building something out of nothing and solving problems and also like making good money. So I code all day and code all night to accomplish these unrelated goals and fancy myself the unhacker hacker.

</comment><comment><USER18> A TI-83+ silver edition was my first programming experience in 8th grade. All I knew was TI-basic with its 2 character labels for goto and one character variables. I tried to program a game and filled up a page with notes on what the code at the 100 different labels did... you can imagine my shock when I first saw functions and arrays in C!

</comment><comment><USER19> In high school. Actually not in school because school didn't have any computers.

There was a business machines store with a Commodore PET in the window, and a Radio Shack with a TRS-80 Model 1 on display. I was allowed to sit and program on them in return for answering any questions the customers asked of me.

</comment><comment><USER20> I loved playing video games and I wanted to write my own. When I was 9 I learned HTML and took an online C class (which both got me hooked), then I tried Java and was scared away by the look of the "public static void main" of all things, so I went with C++.

Yes, I realize how utterly backwards that is.

</comment><comment><USER21> In high school. I joined an online community and started building a (hideous) website related to it on Angelfire. Went from HTML to Javascript to Perl to the Wonderful World of Linux, all within a year or so. Now I'm primarily a PHP dev but I tinker in everything from Python to Ruby to plain ol' C

</comment><comment><USER22> High school, TI-89 graphing calculator. Made some games using the built-in BASIC, then moved on to C. Twiddling bits to read input registers and write framebuffers was incredibly educational; that calculator taught me more about programming than math.

</comment><comment><USER23> 1981 at age 9. I finished a computer summer camp curriculum in the first week, then audited college computer classes for 3 years. I still remember late nights sitting at a giant VAX terminal working on my algorithms homework at age 10.

</comment><comment><USER24> This did it for me:

      10 PRINT "DAMON"
      20 GOTO 10

I think it was 2nd grade at the school library. Both computers constantly had some witty phrase infinitely looping down their screens...

</comment><comment><USER25> It seems that everyone here started programming at the age of 7, reverse- engineering at 12 and hacking banks by High school

Anybody who started late, and still like it?

</comment><comment><USER26> After I started working :) (i.e. after I got my job).

</comment><comment><USER27> I created some AOL "progs" in VB6 that did stupid stuff like scroll in the chat and faded your text different colors.

</comment><comment><USER28> I ran out of games on my C+4, when I was six. My father helped me write a simple BASIC program, and I was hooked.

</comment><comment><USER29> HyperCard</comment>


How to Get a FREE "HTTPS" for Your Domain (Using AWS) - <AUTHOR> https://hackernoon.com/how-to-get-a-free-https-for-your-domain-using-aws-68140d176efb <comment><USER2> How is this easier or better than using Lets Encrypt?</comment>


Replace Spotify Ads with Zen Music (Or Anything You Want) - <AUTHOR> https://github.com/thesanjeetc/ReplaceSpotifyAds <comment><USER2> I'd be very interested to hear from a Lawyer what are the implication of doing something like this. Controlling the last mile of fruition (in this case the browser) can open a lot of opportunities (ie.: replacing podcast ads with contextual one, etc). But I wonder if this is legal or not.</comment>


Ask HN: Someone is interested in purchasing ownership of my plugin. Is a scam? - <AUTHOR> Some time ago I wrote a little plugin for WordPress, it is in the official repository and stats says it has 10000+ active installs. The other day someone sent me this email:

  Hi [redacted],

  We have been searching through Wordpress for some plugins of personal interest and came across yours. We are interested in discussing some of the details of your plugin and if you are available.

  If we can come to an agreement then we would be interested in purchasing ownership of your plugin [redacted] on the wordpress.org repository.

  We would be willing to pay $150.00 USD for every 1,000 installs.

  This is a one time message, you will no longer receive any messages from us. We apologize for any inconvenience.

  Let us know if your interested.

  [redacted] Sales Team
 It looks like an automated mail and obviously suspicious. Does anyone knows more about this? Is this a known scam pattern or what? <comment><USER2> Even if it is legitimate, it's probably not fooling around with for a net sale of $1500. There's too much due diligence.

Good luck.</comment>


Ravelry's Architecture - a-priori http://codemonkey.ravelry.com/2010/03/24/ravelry-runs-on-2010/

<comment><AUTHOR> This is even better than his last writeup. Interesting about the financial tradeoffs of running his own server instead of something like EC2, but he still relies on S3 for terabytes of storage. He mentioned that they have a fairly even load with few spikes, so the advantage of spinning up new instances on EC2 is not applicable to his and his wife's business.</comment>


Show HN: CLI for trying out Node.js modules easier - <AUTHOR> https://github.com/VictorBjelkholm/trymodule <comment><USER2> This is one of those really cool ideas that is obvious after someone else much smarter then yourself thinks of it first.

I wish this was in NPM.

<comment><USER3> Actually it is, at least the npm website. Every page on npm has a "try it now" link that takes you to a page on tonicdev where you can try the package. For example: [http://tonicdev.com/npm/canvas](http://tonicdev.com/npm/canvas) \- no need to download, build, or install. It loads a container so you have a real node environment (I'm a dev in this if you have any questions).

<comment><USER4> I use this regularly - it's great. Only issue is I can never remember the domain name! :)

It'd actually be pretty helpful if you made it something like [https://try.tonicdev.com/npm/canvas](https://try.tonicdev.com/npm/canvas) because then I can just type "try." and my browser will find it for me.

</comment></comment></comment><comment><USER5> Just 57 lines of code. Someone was asking about beautiful code in other thread, I believe this is a fine example of it. Plumbing together reusable modules to build useful (and never before imagined) stuff. Kudos to the author and the node.js ecosystem..

<comment><AUTHOR> Yeah, saw that though but can't agree that this would be an example of it. It's more an example of the later part, the beauty of having small modules, ready to be used and just plumbing them together in a small way.

Thanks for the kind words though, warms my heart that someone likes it.

</comment></comment><comment><USER6> It would be very cool to detect an example from npm docs or github repo and input it initially!

<comment><USER3> A bunch of npm modules now provide tonicExample or tonicExampleFilename, which is used by npm/tonic try it now: [https://tonicdev.uservoice.com/knowledgebase/articles/765846...](https://tonicdev.uservoice.com/knowledgebase/articles/765846-how- do-i-customize-the-example-for-my-npm-package)

</comment></comment><comment><USER7> Next step: a try-it-on-the-web interface?

<comment><USER8> Doesn't that already exist on the NPM interface? The "try it now in your browser" which links to TonicDev. Or are you suggesting something else?

<comment><USER7> In that case, why would we need a CLI tool for trying out packages?

<comment><AUTHOR> Offline capabilities + easier to use for some people (one of them being me). Loading up a webpage every time I want to try some new nodejs module would not work as well as opening up a nodejs repl with the module loaded there.

<comment><USER9> Obviously it won't work offline if you haven't already installed the package (which seems like the general case?)

I'm biased of course, and I understand why some people are turned off by an in browser solution. But I think it's probably faster, in most cases, to try something you've never installed in Tonic than in this. (And I hope there's genuine value in things like being able to share links to your experiments.)

<comment><AUTHOR> Yeah, that is true for sure, difference being that the 10% use-case (installed package before, offline now) is still usable if it's local and not on tonic- dev.

I like tonic-dev, don't get me wrong. But the workflow for using a package in tonic-dev is too slow compared to having it in a REPL, at least for me. Might be because I'm using Firefox and the performance for tonic-dev is terrible there, but mostly because I feel more at home in the terminal than in a js- editor in the browser.

<comment><USER9> Understood. We definitely have work to do in Firefox.</comment></comment></comment></comment></comment></comment></comment>


Liquid Web offering up to $25K in free hosting for startups - <AUTHOR> http://detroit.cbslocal.com/2013/01/09/liquid-web-offering-startups-free-hosting/

<comment><AUTHOR> <http://www.liquidweb.com/incubator.html> is where the link on the cbslocal article's page should point to

</comment><comment><USER2> Uhm, who's going to tell them that cliking the link hits their OWA page...

<comment><AUTHOR> Nice, I didn't see tha. The article's link to LW's info listed on the cbs page shows the verbiage correctly but the location in the tag is wrong so the clicks don't work.</comment></comment>